Secure Your Clusters with SAML

These steps show how you can secure your Elasticsearch clusters and Kibana instances in a deployment by using a Security Assertion Markup Language (SAML) identity provider (IdP) for cross-domain, single sign-on authentication.

The SAML credentials are valid against the deployment, not the ECE platform.

Before You Begin

ECE supports SAML with Elastic Stack version 6.4 and later.

The steps in this section require an understanding of SAML, specifically the SAML 2.0 Web Browser SSO Profile. To learn more about SAML, see:

The SAML realm name cloud-saml is reserved for internal use only and you cannot use it. Choose a different name, such as the one shown in the example.

Defines the SAML attribute that is going to be mapped to the principal (username) of the authenticated user in Kibana. In this example, nameid:persistent maps the NameID with the urn:oasis:names:tc:SAML:2.0:nameid-format:persistent format from the Subject of the SAML Assertion. See the attribute mapping documentation
for details and available options.

Defines the SAML attribute used for role mapping when configured in Kibana. Common choices are groups or roles. The values for both attributes.principal and attributes.groups depend on the IdP provider, so be sure to review their documentation. See the attribute mapping documentation for details and available options.

The file path or the HTTPS URL where your IdP metadata is available, such as https://idpurl.com/sso/saml/metadata. If you configure a URL you need to make ensure that your Elasticsearch cluster can access it.

The SAML EntityID of your IdP. This can be read from the configuration page of the IdP, or its SAML metadata, such as https://idpurl.com/entity_id.

Replace KIBANA_ENDPOINT_URL with the one noted in the previous step, such as sp.entity_id: https://d1a45bf330b74c248d7cc2e0ead8e359.192.168.44.10.ip.es.io:9243/, including the slash at the end.

By default, users authenticating via SAML have no roles assigned to them. For example, if you want all your users authenticating with SAML to get access to Kibana, issue the following request to Elasticsearch:

Alternatively, if you want the users that belong to the group elasticadmins in your identity provider to be assigned the superuser role in your Elasticsearch cluster, issue the following request to Elasticsearch:

This configuration disables all other realms and only allows users to authenticate with SAML. If you wish to allow your native realm users to authenticate, you need to also enable the basicauthProvider by setting xpack.security.authProviders: [saml, basic] in the configuration of Kibana.
You can then access the Kibana login screen at https://d1a45bf330b74c248d7cc2e0ead8e159.192.168.44.10.ip.es.io:9243/login

Optional: If your Identity Provider doesn’t publish its SAML metadata at an http URL, or if your Elasticsearch cluster cannot reach that URL, you can upload the SAML metadata as a file.

Prepare a ZIP file with a
custom bundle
that contains your Identity Provider’s metadata (metadata.xml) inside of a saml folder.

This bundle allows all Elasticsearch containers to access the metadata file.

Update your Elasticsearch cluster configuration using the advanced configuration editor to use the bundle you prepared in the previous step. You need to modify the user_bundles JSON attribute similar to the following example snippet:

The URLs that point to the ZIP file containing the bundle must be accessible to the deployment.

Custom bundles are unzipped under the path /app/config/BUNDLE_DIRECTORY_STRUCTURE, where BUNDLE_DIRECTORY_STRUCTURE is the directory structure in the ZIP file. Make sure to save the file location where custom bundles get unzipped, as you will need it in the next step.

In our example, the SAML metadata file will be located in the path /app/config/saml/metadata.xml:

$ tree .
.
└── saml
└── metadata.xml

Adjust your saml realm configuration accordingly:

idp.metadata.path: /app/config/saml/metadata.xml

The path to the SAML metadata file that was uploaded

After completing these steps, you can log into Kibana by authenticating against your SAML IdP.